Fix invalid selection produced when dragging mouse outside the SVG text element

third_party/WebKit/Source/core/layout/svg/LayoutSVGRoot.cpp

 /*
  * Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2004, 2005, 2007, 2008, 2009 Rob Buis <buis@kde.org>
  * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Google, Inc.
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 10 matching lines @@
  * Boston, MA 02110-1301, USA.
  */
 
 #include "core/layout/svg/LayoutSVGRoot.h"
 
 #include "core/frame/LocalFrame.h"
 #include "core/layout/HitTestResult.h"
 #include "core/layout/LayoutAnalyzer.h"
 #include "core/layout/LayoutPart.h"
 #include "core/layout/LayoutView.h"
+#include "core/layout/svg/LayoutSVGText.h"
 #include "core/layout/svg/SVGLayoutSupport.h"
 #include "core/layout/svg/SVGResourcesCache.h"
 #include "core/paint/PaintLayer.h"
 #include "core/paint/SVGRootPainter.h"
 #include "core/svg/SVGElement.h"
 #include "core/svg/SVGSVGElement.h"
 #include "core/svg/graphics/SVGImage.h"
 #include "platform/LengthFunctions.h"
 
 namespace blink {
@@ skipping 233 matching lines @@
     LayoutReplaced::insertedIntoTree();
     SVGResourcesCache::clientWasAddedToTree(this, styleRef());
 }
 
 void LayoutSVGRoot::willBeRemovedFromTree()
 {
     SVGResourcesCache::clientWillBeRemovedFromTree(this);
     LayoutReplaced::willBeRemovedFromTree();
 }
 
+PositionWithAffinity LayoutSVGRoot::positionForPoint(const LayoutPoint& point)
+{
+    FloatPoint absolutePoint = FloatPoint(point);
+    absolutePoint = m_localToBorderBoxTransform.inverse().mapPoint(absolutePoint);
+    LayoutObject* closestDescendant = SVGLayoutSupport::findClosestLayoutSVGText(this, absolutePoint);
+
+    if (!closestDescendant)
+        return LayoutReplaced::positionForPoint(point);
+
+    if (closestDescendant)

[fs, 2016/01/19 16:12:46]

You trivially know this (checked 3 lines before.) The toLayoutSVGText cast below
should also be asserting this already (and more firmly so.)

+        ASSERT(closestDescendant->isSVGText());
+
+    LayoutObject* layoutObject = closestDescendant;
+    AffineTransform transform = closestDescendant->localToParentTransform();
+    transform.translate(toLayoutSVGText(closestDescendant)->location().x(), toLayoutSVGText(closestDescendant)->location().y());
+    while (layoutObject) {
+        layoutObject = layoutObject->parent();
+        if (layoutObject->isSVGRoot())
+            break;
+        transform = layoutObject->localToParentTransform() * transform;
+    }
+
+    absolutePoint = transform.inverse().mapPoint(absolutePoint);
+
+    return closestDescendant->positionForPoint(LayoutPoint(absolutePoint));
+}
+
 // LayoutBox methods will expect coordinates w/o any transforms in coordinates
 // relative to our borderBox origin.  This method gives us exactly that.
 void LayoutSVGRoot::buildLocalToBorderBoxTransform()
 {
     SVGSVGElement* svg = toSVGSVGElement(node());
     ASSERT(svg);
     float scale = style()->effectiveZoom();
     FloatPoint translate = svg->currentTranslate();
     LayoutSize borderAndPadding(borderLeft() + paddingLeft(), borderTop() + paddingTop());
     m_localToBorderBoxTransform = svg->viewBoxToViewTransform(contentWidth() / scale, contentHeight() / scale);
@@ skipping 115 matching lines @@
             updateHitTestResult(result, pointInBorderBox);
             if (!result.addNodeToListBasedTestResult(node(), locationInContainer, boundsRect))
                 return true;
         }
     }
 
     return false;
 }
 
 }